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TMTRF CLAIMS: 
Amended claims follow: 

1. (Previously Amended) A computer program product for detecting an outbreak of a computer 
virus on a computer apparatus, said computer program product comprising: 



(0 



measurement computer code operable to measure one or more measurement 
parameters indicative of non virus specific activity of said computer apparatus over a 

respective measurement period; 



(ii) comparison computer code operable to compare said one or more measurement 
parameters with respective predetermined threshold levels; and 

(iii) signal generating computer code operable to generate a signal indicative of an 
outbreak of a computer virus if one or more of said one or more measurement 
parameters crosses a respective predetermined threshold level; 

wherein one of said measurement parameters is how many e-mail messages are sent 
having an identical message title. 

2. (Cancelled) 

3 (Original) A computer program product as claimed in claim 1, wherein one of said 
measurement parameters is how many e-mail messages are sent having an identical file attachment. 

4. (Original) A computer program product as claimed in claim 1, wherein one of said 
measurement parameters is how many e-mail messages are sent having a file attachment of a given 
file type. 



Docket: NAI1P154_99.078.01 -2- 

PACE 5/15 * RCVD AT 7/29/2004 6:28:36 PM [Eastern Daylight Time] « SVR:USPTO-EFXRF-1/2* DNIS: 8729306 » CS1D:408 971 4660 * DURATION (mm-ss):05-00 



Jul 29 04 02:3Gp SVIPG 408 971 48G0 p. 6 



5. (Original) A computer program product as claimed in claim 4, wherein said given file type 
is an executable file type. 

6. (Original) A computer program product as claimed in claim 1 , wherein one of said 
measurement parameters is e-mail throughput within said computer system. 

7. (Original) A computer program product is claimed in claim 6, wherein each e-mail processed 
has an associated size value and e-mail throughput is measured in a form dependent upon a number 
of e-mails multiplied by a total of size values for said e-mails. 

8. (Original) A computer program product as claimed in claim 1, wherein said respective 
predetermined.threshold levels are varied in dependence upon time of day. 

9. (Original) A computer program product as claimed in claim 1 , wherein said respective - 
predetermined threshold levels are varied in dependence upon day of week. 

10. (Original) A computer program product as claimed in claim 1 , wherein said one or more 
measurement parameters are user selectable. 

1 1 . (Original) A computer program product as claimed in claim 1 , wherein said respective 
measurements periods are user selectable. 

12. (Original) A computer program product as claimed in claim 1, wherein said respective 
predetermined threshold levels are user selectable. 

1 3. (Previously Amended) A method of detecting an outbreak of a computer virus on a computer 
apparatus, said method comprising the steps of: 

(i) measuring one or more measurement parameters indicative of non virus specific 
activity of said computer apparatus over a respective measurement period; 
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0Q comparing said on. or more measurement parameters with respective predetermined 

threshold levels; and 

(iii) generating a signal indicative of an outbreak of a computer virus if one or more of 
said one or more measurement parameters crosses a respective predetermined 
threshold level; 

wherein one of said measurement parameters is how many e-mail messages are sent 
having an identical message title. 

14. (Cancelled) 

15. (Original) A method as claimed in claim 13, wherein one of said measurement parameters is 
how many e-mail messages are sent having an identical file attachment. 

16. (Original) A method as claimed in claim 13, wherein one of said measurement parameters is 
how many e-mail messages are sent having a file attachment of a given 

file type. 

17. (Original) A method as claimed in claim 16, wherein said given file type is an executable file 
type. 

18 . (Original) A method as claimed in claim 13, wherein one of said measurement parameters is 
e-mail throughput within said computer system. 

19 (Original) A method as claimed in claim 1 8, wherein each e-mail processed has an associated 
size value and e-mail throughput is measured in a form dependent upon a number of e-mails 
multiplied by a total of size values for said e-mails. 

20. (Original) A method as claimed in claim a 13, wherein said respective predetermined 
threshold levels are varied in dependence upon time of day. 
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21 . (Original) A method as claimed in claim 13, therein said respective predetermined threshold 
levels are varied in dependence upon day of week. 

22. (Original) A method as claimed in claim 13, wherein said one or more measurement 
parameters are user selectable. 

23. (Original) A method as claimed in claim 13, wherein said respective measurements periods 
are user selectable. 

24. (Original) A method as claimed in claim 13, wherein said respective predetermined threshold 

levels are user selectable. 

p2S. (Previously Amended) Apparatus for detecting an outbreak of a computer virus on a 
computer apparatus, said apparatus comprising: 

(i) measuring logic operable to measure one or more measurement parameters indicative 
of non virus specific activity of said computer apparatus over a respective 
measurement period; 

(ii) comparing logic operable to compare said one or more measurement parameters with 
respective predetermined threshold levels; and 

(iii) signal generating logic operable to generate a signal indicative of an outbreak of a 
computer virus if one or more of said one or more measurement parameters crosses a 
respective predetermined threshold level; 

wherein one of said measurement parameters is how many e-mail messages are sent 
having an identical message title. 
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26. (Cancelled) 

27. (Original) Apparatus as claimed in claim 25, wherein one of said measurement parameters is 
how many e-mail messages are sent having an identical file attachment. 

28. (Original) Apparatus as claimed in claim 25, wherein one of said measurement parameters is 
how many e-mail messages are sent having a file attachment of a given file type. 

29. (Original) Apparatus as claimed in claim 28, wherein said given file type is an executable file 
type. 

30. (Original) Apparatus as claimed in claim 25, wherein one of said measurement parameters is 
e-mail throughput within said computer system. 

31 (Original) Apparatus as clammed in claim 30, wherein each e-mail processed has an 
associated size value and e-mail throughput is measured in a form dependent upon a number of e- 
mails multiplied by a total of size values for said e-mails. 

32. (Original) Apparatus as claimed in claim 25, wherein said respective predetermined threshold 
levels are varied in dependence upon time of day. 

33. (Original) Apparatus as claimed in claim 25, wherein said respective predetermined threshold 
levels are varied in dependence upon day of week. 

34. (Original) Apparatus as claimed in claim 25, wherein said one or more measurement 
parameters are user selectable. 

35 . (Original) Apparatus as claimed in clam in 25, wherein said respective measurements periods 
are user selectable. 

36. (Original) Apparatus as claimed in claim 25, wherein said respective predetermined threshold 
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levels are user selectable. 
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